Cyber Resilience

CVE-2024-8673

CriticalPublic PoC

Published: 15 May 2025

Published
15 May 2025
Modified
28 May 2025
KEV Added
Patch
CVSS Score v3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0583 90.7th percentile
Risk Priority 22 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-8673 is a critical-severity an unspecified weakness vulnerability in Urbanbase Z-Downloads. Its CVSS base score is 9.1 (Critical).

Operationally, ranked in the top 9.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

The Z-Downloads WordPress plugin before version 1.11.7 contains a file-upload flaw that fails to validate SVG files, allowing those containing embedded malicious JavaScript to be stored on the server. The affected component is the plugin’s upload-handling routine, which accepts untrusted file content without sufficient type or content checks.

An unauthenticated remote attacker can send a crafted SVG directly to the upload endpoint. Successful exploitation yields high-impact effects on confidentiality and integrity, enabling stored cross-site scripting or arbitrary script execution within the WordPress site context, as reflected in the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Public advisories hosted on WPScan document the issue and indicate that the vendor addressed it by releasing version 1.11.7, which restores proper file validation. The associated EPSS score has remained low and essentially flat (current 0.0583, peak 0.0668), providing no indication of emerging exploitation interest after disclosure.

EU & UK References

Vulnerability details

The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

urbanbase
z-downloads
≤ 1.11.7

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References